VERIFICATION OF THE INTEGRITY OF A CIPHERING KEY
A method for verifying the integrity of a key implemented in a symmetrical ciphering or deciphering algorithm, including the steps of complementing to one at least the key; and verifying the coherence between two executions of the algorithm, respectively with the key and with the key complemented to one.
Latest STMicroelectronics (Rousset) SAS Patents:
This application claims the priority benefit of French patent application number 08/53198, filed on May 16, 2008, entitled “VERIFICATION OF THE INTEGRITY OF A CIPHERING KEY,” which is hereby incorporated by reference to the maximum extent allowable by law.
BACKGROUND OF THE INVENTION1. Field of the Invention
The present invention generally relates to electronic circuits and, more specifically, to data processing units implementing ciphering or deciphering algorithms. The present invention more specifically relates to mechanisms for verifying the integrity of a key manipulated by such algorithms.
2. Discussion of the Related Art
When a processing unit (typically a cryptoprocessor) is used to implement a ciphering algorithm, it should be verified that the manipulated key has not been modified (incidentally or intentionally), either during transfer to the cryptoprocessor from an external circuit, or after transfer while it is stored in a specific register of the cryptoprocessor.
To avoid a modification during the transfer, a solution is to recharge the key in the cryptoprocessor as often as possible, generally on each new ciphering, or periodically.
To check the integrity of the key once it is in the cryptoprocessor, the simplest would be to read this key to control it outside of the cryptoprocessor. However, to protect the key against possible hacking attempts, the temporary storage element (register) which contains the key is only accessible from outside of the cryptoprocessor in write mode. The integrity verification then comprises verifying the coherence of results obtained by two separate calculations using the key contained in the cryptoprocessor. The two calculations are either two cipherings of a same message with the key, or a ciphering followed by a deciphering.
However, if one of the bits of the key is modified in the key register and this register is not modified between the two calculations (be they successive or in parallel) or if it undergoes the same modification during both loadings, the verification mechanism is incapable of noticing it.
SUMMARY OF THE INVENTIONIt would be desirable to have a mechanism for verifying the integrity of a key manipulated by a ciphering key, which overcomes all or part of the disadvantages of usual integrity verification mechanisms.
It would also be desirable to detect a modification of the key in the internal register of the cryptoprocessor, even if this register is not accessible in read mode from the outside.
It would also be desirable to detect an inversion of one or several bits of the key in a verification mechanism implementing two executions of the calculation (double ciphering, double deciphering, ciphering followed by a deciphering or the opposite).
To achieve all or part of these objects as well as others, at least one embodiment of the present invention provides a method for verifying the integrity of a key implemented in a symmetrical ciphering or deciphering algorithm, comprising the steps of:
complementing to one at least the key; and
verifying the coherence between two executions of the algorithm, respectively with the key and with the key complemented to one.
According to an embodiment, the result of a first execution of the algorithm with a data value and the key, or the complement to one of this result, is compared with the complement to one of the result of a second execution of the algorithm with the data value complemented to one and the key complemented to one, respectively with the result of this second execution.
According to an embodiment, a first execution of an algorithm of ciphering or deciphering of a data value with the key is followed by an execution of a corresponding deciphering or ciphering algorithm with the complemented result of the first execution and the complemented key.
According to an embodiment, the result of the second execution or its complement to one is compared with the complement to one of the data value or with the data value.
According to an embodiment, the verification compares two successive executions.
According to an embodiment, the verification compares two parallel executions.
According to an embodiment, the used algorithm is the DES or one of its variations.
At least one embodiment of the present invention also provides an electronic circuit capable of implementing the verification method.
At least one embodiment of the present invention also provides a system comprising an electronic ciphering or deciphering circuit and an electronic circuit for processing ciphered data or deciphered data.
The foregoing objects, features, and advantages of the present invention will be discussed in detail in the following non-limiting description of specific embodiments in connection with the accompanying drawings.
The same elements have been designated with the same reference numerals in the different drawings. For clarity, only those steps and elements which are useful to the understanding of the present invention have been shown and will be described. In particular, the use of the data to be ciphered or of the ciphered data has not been detailed, the present invention being compatible with any common use. Further, the elements of the cryptographic processing unit or of the other circuits have not been detailed, the present invention being here again compatible with usual structures. Reference will be made hereafter to the word “ciphering” to designate, unless otherwise specified, a ciphering and/or a deciphering, which are similar mechanisms (application of an algorithm to data and one or several keys).
The use of ciphering algorithms finds many applications in the electronics industry for integrated circuit card systems, toll television systems, ciphered communication systems, etc. In all cases, an algorithmic processing unit capable of implementing ciphering and/or deciphering mechanisms can be found.
The considered algorithms are so-called Feistel algorithms. Such algorithms perform a symmetrical ciphering, by blocks, and are characterized by ciphering ad deciphering operations which are similar, or even identical, and only require an inversion of the order of use of keys (or sub-keys) extracted from the key contained in the key register. Most often, Feistel networks or diagrams combine several rounds of identical operations including a diffusion function (for example, a permutation of the bits), a non-linear function (for example, of substitution) generating a confusion effect, and a linear mixing using a bit-to-bit combination (XOR). Among Feistel algorithms, those in which the result of the ciphering of a message by a key is equal to the complement to one of the result of the ciphering of the complement to one of the message by the complement to one of the key will be selected.
An example of a Feistel algorithm which has this property is the DES algorithm and its different variations. Other examples are the algorithms known as LOKI and GHOST.
The ciphering algorithm (
The deciphering operation (
In the case of the DES algorithm, the first round is preceded by a bit-mixing operation (permutation) and the last round is followed by the inverse operation.
To check the integrity of key K stored in register 5, a simple solution would be to be able to reread this key for verification purposes. However, as already indicated, register 5 is not accessible from the outside other than in write mode. Accordingly, the integrity verification must use an indirect mechanism.
K key is thus used twice in a row or in parallel to perform two ciphering operations having their results compared to each other, or a ciphering operation followed by a deciphering operation, and the identity between the original and final messages is then verified.
This implementation takes advantage of the previously-indicated property (for any message P and any key K, the complement to one C′ of result C of ciphering algorithm A is equal to the result of the application of this algorithm to complemented message P′ with complemented key K′). Thus, the result (f(X, Ki)) of the application of the non-linear function f to a data value X with a sub-key Ki is equal to the result (f(X′, Ki′)) of its application to the complements to one X′ of the data value and Ki′ of the sub-key. Among Feistel algorithms, those having such a function will be selected. Such is especially the case for the DES, LOKI, and GHOST algorithms, but not for those known as RC5, Twofish, Blowfish, or Camelia.
An advantage of using the complement to one is that an inversion of one bit in key K or in its complement to one K′ will not provide the same result. Accordingly, an incidental or intentional modification of a bit of the key in one of key registers 51 or 52 may be detected by the verification mechanism. Further, a modification of a same bit in both registers 51 and 52 will also alter the result. The only case where a modification is not detected is the case where all the modified bits of one of registers 51 or 52 are also inverted in the other register 52 or 51 and where the corresponding bits of the right-hand portion are also inverted during their interaction with the sub-key bits used by function f. The incidental occurrence of such a case is however improbable and it is difficult to cause it intentionally.
The steps listed hereafter illustrate an example of successive operations, using a same calculation cell of the DES of circuit 3 (this example corresponds to a variation of
1. Loading of register 51 with key K;
2. Loading of plain text P into register 61;
3. Selection of register 51 as the key register of the DES;
4. Execution of the DES;
5. Transfer of the content, noted C1, of register 61 to a temporary storage element (for example, a first register dedicated to the integrity verification or an output register);
6. Calculation of complement P′ based on message P;
7. Loading of P′ into register 61;
8. Calculation of complement K′ based on key K of register 51;
9. Loading of register 52 with key K′;
10. Selection of register 52 as a key register of the DES;
11. Execution of the DES;
12. Transfer of the content, noted C2, of register 61 to a temporary storage element (for example, a second register dedicated to the integrity verification);
13. Calculation of complement C1′ of content C1 of the first register; and
14. Verifying that C1′=C2.
The result which may be obtained from the cryptoprocessor (placed in an internal storage element, accessible in read mode by central unit 2 or another circuit using processor 3) is in any of the first and second registers and has been verified.
The steps listed hereafter illustrate an example of successive operations, using a same calculation cell of the DES of circuit 3, but to perform, as in
1. Loading of register 51 with key K;
2. Loading of plain text P into register 61;
3. Selection of register 51 as a key register of the DES;
4. Execution of the DES;
5. Transfer of the content, noted C1, of register 61 to a temporary storage element (for example, a first register 75 dedicated to the integrity verification or an output register);
6. Calculation of complement C1′ based on result C1;
7. Loading of C1′ into register 61;
8. Calculation of complement K′ based on K of register 51;
9. Loading of register 52 (or, as a variation, of register 51) with key K′;
10. Selection of register 52 (or of register 51 in the variation) as a key register of the DES−1;
11. Execution of the DES−1;
12. Transfer of the content, noted P2, of register 61 to a temporary storage element (for example, a second register dedicated to the integrity verification);
13. Calculation of complement P2′ of the content of this second register; and
14. Verifying that P2′=P.
The result is in register 61 and has been verified.
The steps listed hereafter illustrate an example of successive operations, using a same calculation cell of the DES of circuit 3 to perform a ciphering, followed by a deciphering (DES−1), assuming that the cryptoprocessor integrates the complement-to-one calculation function:
1. Loading of register 51 with key K;
2. Loading of plain text P into register 61;
3. Selection of register 51 as a key register of the DES;
4. Execution of the DES;
5. Transfer of the content of register 61 to a temporary storage element (for example, a first register dedicated to the integrity verification or an output register);
6. Calculation of the complement of the content of register 61;
7. Loading of register 52 with key K;
8. Calculation of complement K′ of the content of register 52;
9. Selection of register 52 as a key register of the DES−1;
10. Execution of the DES−1;
11. Calculation of the complement of the content of register 61;
12. Transfer of the content of register 61 to a temporary storage element (for example, a second register dedicated to the integrity verification);
13. Verifying that this register contains original message P.
The result is in the first register and has been verified.
It is now possible to verify the integrity of a key used in a ciphering algorithm of Feistel algorithm type.
This verification is compatible with the usual structures of cryptoprocessors and requires no modification thereof (except, for certain variations, for the complement-to-one function if it is desired to be internal to circuit 3). In particular, it is always possible to choose between a parallel or series verification and to share the calculation cell.
The efficiency of such a verification mechanism can be acknowledged by modifying, after the loading of the key into the cryptoprocessor or on each loading of this key, one of the bits of the key register. If this mechanism has been implemented, the error will be detected. If a usual verification mechanism is implemented, the error will not be detected.
An additional advantage of the performed verification is that it not only verifies the integrity of the key but that, additionally, it verifies the very execution of the ciphering algorithm. Indeed, if an error occurs during the execution of the algorithm, the results will not match.
Different embodiments have been described. Different variations are within the abilities of those skilled in the art. In particular, the selection between a parallel or series execution (successive executions) in practice depends on a compromise between the processing speed and the cryptoprocessor bulk. Further, the practical implementation is within the abilities of those skilled in the art based on the functional indications given hereabove, be it for a software or hardware implementation. Further, although the present invention has been described in relation with Feistel algorithms, it more generally applies to symmetrical algorithms for which the result of the ciphering of a message by a key is equal to the complement to one of the result of the ciphering of the complement to one of the message by the complement to one of the key.
Such alterations, modifications, and improvements are intended to be part of this disclosure, and are intended to be within the spirit and the scope of the present invention. Accordingly, the foregoing description is by way of example only and is not intended to be limiting. The present invention is limited only as defined in the following claims and the equivalents thereto.
Claims
1. A method for verifying the integrity of a key used in a symmetrical ciphering or deciphering algorithm, comprising the steps of:
- complementing to one at least the key; and
- verifying the coherence between two executions of the algorithm, respectively with the key and with the key complemented to one.
2. The method of claim 1, wherein the result of a first execution of the algorithm with a data value and the key, or the complement to one of this result, is compared with the complement to one of the result of a second execution of the algorithm with the data value complemented to one and the key complemented to one, respectively with the result of this second execution.
3. The method of claim 1, wherein a first execution of an algorithm of ciphering or deciphering of a data value with the key is followed by an execution of a corresponding deciphering or ciphering algorithm with the complemented result of the first execution and the complemented key.
4. The method of claim 3, wherein the result of the second execution or its complement to one is compared with the complement to one of the data value or with the data value.
5. The method of claim 1, wherein the verification compares two successive executions.
6. The method of claim 1, wherein the verification compares two parallel executions.
7. The method of claim 1, wherein the algorithm used is the DES or one of its variations.
8. An electronic circuit capable of implementing the verification method of claim 1.
Type: Application
Filed: May 14, 2009
Publication Date: Nov 19, 2009
Patent Grant number: 8848917
Applicant: STMicroelectronics (Rousset) SAS (Rousset)
Inventors: Pierre-Yvan Liardet (Peynier), Yannick Teglia (Marseille)
Application Number: 12/466,284